Choose what runs and what the assistant sees.
Actions use your endpoint. You decide what it may request, whether to limit the response fields for the assistant, and whether a visitor must prove who they are.
- Limit which response fields the assistant sees
- After testing, you can select JSON response fields. If you select at least one, only those fields are included in the result for the assistant. With no selection, the full API response is used.
- A check for personal records
- For customer-specific lookups, require a verified visitor and match the returned record to that identity, as the WooCommerce order template does. Verification alone does not prove that a requested record belongs to them.
- A decision before a write
- POST actions are treated as changes by default. In website chat the visitor reviews the proposed values and presses Confirm before the request runs. A POST endpoint that truly only reads can be explicitly marked read-only.
Suitable read actions can run in connected WhatsApp, Messenger and Instagram conversations when the identity required by that action is available. Write actions that require a confirmation card run only in the website chat widget.